GeezerVison is showing github.com — sqlmap/tests/test_httpshandler.py at master · sqlmapproject/sqlmap

Expand file tree

test_httpshandler.py

Copy path

More file actions

Latest commit

History

109 lines (80 loc) · 3.69 KB

test_httpshandler.py

Copy path

File metadata and controls

109 lines (80 loc) · 3.69 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

100

101

102

103

104

105

106

107

108

109

#!/usr/bin/env python

"""

See the file 'LICENSE' for copying permission

Unit tests for lib/request/httpshandler.py, exercising the SSL protocol

candidate selection.

No network is involved: the module is reimported with chosen ssl.PROTOCOL_*

constants removed, mimicking OpenSSL builds that have those protocol versions

compiled out (e.g. OPENSSL_NO_TLS1), as the constants are conditional there.

"""

import os

import ssl

import sys

import unittest

sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))

from _testutils import bootstrap

bootstrap()

from lib.core.data import conf

import lib.request.httpshandler as hmod

from thirdparty.six.moves import reload_module as _reload_module

class TestProtocolSelection(unittest.TestCase):

def tearDown(self):

hmod.socket.create_connection = self._createConnection

hmod.ssl.SSLContext = self._sslContext

hmod._contexts.clear()

for name, value in self._removed.items():

setattr(ssl, name, value)

_reload_module(hmod)

def _reload_without(self, *names):

"""Reloads the module with `names` missing from ssl (as on builds lacking those protocols)"""

self._removed = {}

self._createConnection = hmod.socket.create_connection

self._sslContext = hmod.ssl.SSLContext

for name in names:

if hasattr(ssl, name):

self._removed[name] = getattr(ssl, name)

delattr(ssl, name)

_reload_module(hmod)

return [hmod._lut.get(_, _) for _ in hmod._protocols if _ in hmod._tlsProtocols]

def test_only_tls_protocols_are_used_with_sni(self):

# Note: SSL era protocols stay in _protocols for the non-SNI fallback, but carry no server_hostname

selected = self._reload_without()

self.assertTrue(selected)

for name in ("PROTOCOL_SSLv3", "PROTOCOL_SSLv23", "PROTOCOL_SSLv2"):

if hasattr(ssl, name):

self.assertIn(getattr(ssl, name), hmod._protocols)

self.assertNotIn(getattr(ssl, name), hmod._tlsProtocols)

def test_missing_tlsv1_does_not_raise(self):

# Note: ssl.PROTOCOL_TLSv1 is compiled in only '#ifndef OPENSSL_NO_TLS1' (used to raise an AttributeError here)

selected = self._reload_without("PROTOCOL_TLSv1")

self.assertTrue(selected)

self.assertNotIn("PROTOCOL_TLSv1", selected)

def test_missing_all_legacy_tls_does_not_raise(self):

selected = self._reload_without("PROTOCOL_TLSv1", "PROTOCOL_TLSv1_1")

self.assertTrue(selected)

self.assertNotIn("PROTOCOL_TLSv1_1", selected)

def test_connect_without_tlsv1(self):

"""Drives the real connect() loop, which used to reference ssl.PROTOCOL_TLSv1 directly"""

selected = self._reload_without("PROTOCOL_TLSv1")

conf.host = None

conf.httpHeaders = []

class _Context(object):

def __init__(self, protocol):

self.protocol = protocol

def set_ciphers(self, _):

pass

def wrap_socket(self, sock, **kwargs):

return "wrapped:%s" % hmod._lut.get(self.protocol, self.protocol)

connection = hmod.HTTPSConnection("example.com", 443)

# Note: stubbed only after the instantiation, as that one resolves the default context through ssl itself

hmod.socket.create_connection = lambda *args, **kwargs: _Socket()

hmod.ssl.SSLContext = _Context

hmod._contexts.clear()

connection.connect()

self.assertEqual(connection.sock, "wrapped:%s" % selected[0])

class _Socket(object):

def close(self):

pass

if __name__ == "__main__":

unittest.main()